brebhome
A repurposed gaming PC running over a dozen self-hosted services behind a reverse proxy and single sign-on — media, file sync, a searchable photo library, and automation that keeps an eye on itself.
Self-hosted · Docker Compose · since 2024
One box, a dozen services, one login
brebhome is a repurposed gaming PC that's been running as a small home server since 2024. Every service lives in its own Docker Compose stack, sits behind a single nginx reverse proxy, and is gated by Authentik — one login for everything instead of a password per app. It started as "a box that runs Jellyfin" and slowly turned into a small internal cloud.
It's reachable a few different ways depending on what's needed: public services — family websites, Wallos, this portfolio — go out through a Cloudflare-proxied domain in front of nginx, while everything else, like SSH or a browser-based terminal over ttyd, comes in through WireGuard or a Cloudflare Tunnel instead of an open port. A migration to a dedicated, low-power Beelink Me Mini (N150) is planned to replace the gaming PC once one's back in stock.
One gate in front of everything
A single nginx reverse proxy fronts every service, with Authentik sitting in front of that as an SSO gate — one login instead of a password per app, and TLS everywhere. Public traffic for the family websites, Wallos, and this portfolio comes in through a Cloudflare-proxied domain; nothing else is exposed directly.
Jellyfin, without asking me to add things manually
Jellyfin streams the library to every device in the house without a subscription. Jellyseerr sits in front of it with a simple request UI, so the rest of the family can ask for a show or movie instead of pinging me directly.
Finding, downloading, and organizing on autopilot
Sonarr, Radarr, Bazarr, and Jackett automate finding, subtitling, and organizing movies and shows for the Jellyfin library, with Flaresolverr helping Jackett get past Cloudflare-protected trackers. qBittorrent and Transmission handle the actual downloading, both routed entirely through a Gluetun VPN container so their network drops the instant the VPN does.
One copy of the truth, two ways to see it
Nextcloud is the family's own file sync and share, no third party involved — including where everyone's phone photos actually live. Immich mounts that same photo folder as a read-only external library, so it can offer a proper searchable timeline and gallery on top without ever duplicating or taking ownership of the files.
Keeping tabs on the stack automatically
n8n runs a handful of workflows that keep an eye on brebhome itself — probing disk space, checking container health, and running periodic cleanup passes — and drop an alert straight into Discord the moment something needs attention, instead of me finding out days later.
Watching the hardware itself
A Prometheus and node_exporter pair feeds a set of Grafana dashboards tracking CPU, memory, and disk at the hardware level — reachable only over WireGuard, for whenever I want to check on the machine itself rather than what's running on it.
Asleep when nobody needs it, awake when they do
The current box is a repurposed gaming PC, which draws real power even sitting idle — so a systemd service checks every 10 minutes whether the server is actually being used and shuts it down if not. To keep it reachable anyway, Wake-on-LAN is set up so the rest of the family can boot it back up remotely straight from the router's app, no server access required.
The rest of the stack
A few smaller pieces round things out.
- Wallos
Tracks every recurring subscription in one place, so nothing renews as a surprise.
- Cloudflare Tunnel (SSH)
Daily SSH access via "cloudflared access ssh" as a ProxyCommand — no port ever opened on the router.
- ttyd
A browser-based terminal for the times an SSH client isn't handy — another PC, a phone, whatever's in reach.
- Cloudflare DDNS
Keeps the public domain pointed at the house even as the IP changes.
- Docker Compose
- nginx
- Authentik
- Cloudflare Tunnel
- WireGuard
- n8n